Sagan informational stable other

[ONELOGIN] ONELOGIN_DESKTOP_USER_FAILED_ONELOGIN_LOGIN

[ONELOGIN] ONELOGIN_DESKTOP_USER_FAILED_ONELOGIN_LOGIN

View Source

Detection Logic

alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[ONELOGIN] ONELOGIN_DESKTOP_USER_FAILED_ONELOGIN_LOGIN"; json_content: ".event_type_id", "906"; parse_src_ip: 1; classtype: system-event; program: onelogin; json_map:"username",".user_name"; after: track by_src&by_username, count 10, seconds 300; threshold: type limit, track by_src&by_username, count 1, seconds 86400; sid:5006434; rev: 4;)

Field Validations

Loading…

Comments (0)

Loading comments...